Skip to content
Stout
Build Pipelines

Build Pipelines

Enterprise: build packages from source across the supported package formats, each passing through scanning, SBOM, and signing before publish.

GitHub

Common Pipeline

Every ecosystem follows the same pipeline after the ecosystem-specific build step:

1. Clone source

Git clone at specified ref

2. Validate

Check config files match identity

3. Build

Ecosystem-specific build commands

4. Scan

Vulnerability + license checks

5. SBOM

Generate software bill of materials

6. Sign

Sigstore cryptographic signing

7. Publish

Available for installation

Security checks happen after every build

Every ecosystem follows the same pipeline after the ecosystem-specific build step: vulnerability and license checks, SBOM generation, Sigstore cryptographic signing, and publishing.

Ecosystems

GonpmPythonRubyRustDockerHelmMavenNuGetSwiftPHP / ComposerDart / FlutterTerraform ModuleTerraform ProviderAgent

Set Up Source Packages

Source package builds keep install scripts constrained

Scripts are not executed during npm install (--ignore-scripts) for security.
1

Go

go

Config File

go.mod

Artifact

.tar.gz (source archive)

Build Steps

build steps
go mod tidy
go mod verify
tar czf artifact.tar.gz .

Requirements

  • go.mod must be present at project root
  • Module path last segment must match your package name
  • Version in go.mod must match the submitted version

Usage

stout submit go --repo https://github.com/you/mylib --version v1.2.0

Go module proxy also uploads go.mod separately for the GOPROXY .mod endpoint.

2

npm

npm

Config File

package.json

Artifact

.tgz (npm tarball)

Build Steps

build steps
npm install --ignore-scripts
npm pack

Requirements

  • package.json must be present at project root
  • Package name must be scoped: @{owner}/{name}
  • Version in package.json must match the submitted version

Usage

stout submit npm --repo https://github.com/you/mypackage --version 1.0.0

Scripts are not executed during install (--ignore-scripts) for security.

3

Python

python

Config File

pyproject.toml / setup.cfg / setup.py

Artifact

.whl (wheel) preferred, .tar.gz (sdist) fallback

Build Steps

build steps
python -m build

Requirements

  • One of pyproject.toml, setup.cfg, or setup.py must be present
  • Package name (PEP 503 normalized) must match your package name
  • Version must match the submitted version

Usage

stout submit python --repo https://github.com/you/mylib --version 1.0.0

Names are normalized per PEP 503 (lowercase, hyphens to underscores). Extracts author, license, homepage, and dependencies as metadata.

4

Ruby

ruby

Config File

.gemspec

Artifact

.gem (Ruby gem package)

Build Steps

build steps
gem build {gemspec}

Requirements

  • A .gemspec file must be present at project root
  • Gem name and version extracted from the gemspec must match

Usage

stout submit ruby --repo https://github.com/you/mygem --version 1.0.0

Extracts dependencies, authors, license, and homepage from the gemspec.

5

Rust

rust

Config File

Cargo.toml

Artifact

.crate (gzipped tar archive)

Build Steps

build steps
cargo package --no-verify --allow-dirty

Requirements

  • Cargo.toml must be present at project root
  • [package] name must match your package name
  • [package] version must match the submitted version

Usage

stout submit rust --repo https://github.com/you/mycrate --version 1.0.0

Uses --no-verify and --allow-dirty since the build runs in a clean clone environment.

Build Distribution Artifacts

Distribution formats have ecosystem-specific validation

Helm charts are linted before packaging. Any lint errors will fail the build.
6

Docker

docker

Config File

Dockerfile

Artifact

image.tar (OCI image)

Build Steps

build steps
kaniko executor --context=. --dockerfile=Dockerfile --no-push --tarPath=image.tar

Requirements

  • Dockerfile must be present at project root
  • No name/version validation on source (provided at submission time)

Usage

stout submit docker --repo https://github.com/you/myapp --version 1.0.0

Built using Kaniko (no Docker daemon required). Docker images are scanned as a merged filesystem for Grype/OSV CVEs, while per-layer ClamAV and LLM findings are attributed to build steps, including COPY --from provenance, and surfaced as advisory.

7

Helm

helm

Config File

Chart.yaml

Artifact

.tgz (Helm chart archive)

Build Steps

build steps
helm lint .
helm package .

Requirements

  • Chart.yaml must be present at project root
  • Chart name and version must match the submitted values

Usage

stout submit helm --repo https://github.com/you/mychart --version 1.0.0

Chart is linted before packaging. Any lint errors will fail the build.

8

Maven

maven

Config File

pom.xml

Artifact

.jar (Java Archive)

Build Steps

build steps
mvn clean package -DskipTests -q

Requirements

  • pom.xml must be present at project root
  • <artifactId> must match your package name
  • <groupId> must match your owner/namespace
  • <version> must match the submitted version

Usage

stout submit maven --repo https://github.com/you/mylib --version 1.0.0

Tests are skipped during the build (-DskipTests). The first .jar in target/ is used (excluding -sources.jar and -javadoc.jar).

9

NuGet

nuget

Config File

*.csproj / *.fsproj

Artifact

.nupkg (NuGet package)

Build Steps

build steps
dotnet build -c Release
dotnet pack -c Release --no-build -o .

Requirements

  • A .csproj or .fsproj file must be present at project root
  • <PackageId> (or project filename) must match your package name
  • <Version> must match the submitted version

Usage

stout submit nuget --repo https://github.com/you/MyLib --version 1.0.0

Supports both C# (.csproj) and F# (.fsproj) projects. Package ID falls back to the project filename if <PackageId> is not set.

10

Swift

swift

Config File

Package.swift

Artifact

.zip (source archive with compiled artifacts)

Build Steps

build steps
swift build
zip -r artifact.zip . -x ".git/*" -x ".build/*"

Requirements

  • Package.swift must be present at project root
  • Package name (from name: "..." in Package initializer) must match
  • Version is not validated from source (provided at submission time)

Usage

stout submit swift --repo https://github.com/you/MyPackage --version 1.0.0

The Swift package registry follows SE-0292. The full source is archived as a .zip after building.

11

PHP / Composer

php

Config File

composer.json

Artifact

.zip (source archive)

Build Steps

build steps
composer install --no-dev --no-scripts --no-interaction
zip -r artifact.zip . -x ".git/*" -x "vendor/*"

Requirements

  • composer.json must be present at project root
  • "name" must be in vendor/package format
  • Vendor must match your owner/namespace
  • Package must match your package name

Usage

stout submit php --repo https://github.com/you/mypackage --version 1.0.0

Dependencies are installed to verify they resolve, but vendor/ is excluded from the artifact. Scripts are disabled for security.

12

Dart / Flutter

dart

Config File

pubspec.yaml

Artifact

.tar.gz (source archive)

Build Steps

build steps
dart pub get
tar czf artifact.tar.gz --exclude=.git --exclude=.dart_tool .

Requirements

  • pubspec.yaml must be present at project root
  • "name" must match your package name
  • "version" must match the submitted version

Usage

stout submit dart --repo https://github.com/you/mypackage --version 1.0.0

Dependencies are fetched (dart pub get) to verify they resolve before packaging.

Publish Infrastructure & Agents

Infrastructure packages are source-first

Terraform modules are source archives. No compilation is needed. The module is packaged as-is.
13

Terraform Module

terraform_module

Config File

*.tf (any Terraform file)

Artifact

.zip (source archive)

Build Steps

build steps
zip -r artifact.zip . -x ".git/*"

Requirements

  • At least one .tf file must be present at project root
  • No name/version validation on source (modules do not encode these)

Usage

stout submit terraform_module --repo https://github.com/you/terraform-aws-vpc --version 1.0.0

Terraform modules are source archives. No compilation is needed. The module is packaged as-is.

14

Terraform Provider

terraform_provider

Config File

main.go + go.mod

Artifact

.zip (provider binary for linux_amd64)

Build Steps

build steps
go build -o terraform-provider-{name} (GOOS=linux GOARCH=amd64)
zip terraform-provider-{name}_{version}_linux_amd64.zip terraform-provider-{name}

Requirements

  • main.go and go.mod must be present at project root
  • Module path in go.mod must contain "terraform-provider-"
  • Provider name is extracted from the module path

Usage

stout submit terraform_provider --repo https://github.com/you/terraform-provider-example --version 1.0.0

Currently builds for linux/amd64 only. The provider is a Go binary compiled with cross-compilation flags.

15

Agent

agent

Config File

agent.yaml

Artifact

.tar.gz (agent bundle)

Build Steps

build steps
tar czf artifact.tar.gz .

Requirements

  • agent.yaml manifest must be present at project root
  • Manifest must declare name, version, kind, and entry points
  • All declared entry point files must exist in the project

Usage

stout submit agent --repo https://github.com/you/myagent --version 1.0.0

Agents include skills, MCP servers, and agent bundles. The manifest declares permissions, entry points, and compatibility metadata. Publisher verification status is tracked.